Server-Side Request Forgery in OpenClaw's QQBot Media URL Handling
CVE-2026-43526

8.3HIGH

Key Information:

Vendor

Openclaw

Status
Openclaw
Vendor
CVE Published:
5 May 2026

What is CVE-2026-43526?

OpenClaw prior to version 2026.4.12 is susceptible to a server-side request forgery (SSRF) vulnerability due to improper handling of media URLs in the QQBot. Attackers can exploit this flaw by sending malicious media URLs that result in arbitrary content fetching. The fetched content may then be re-uploaded through the QQBot channel, potentially leading to unauthorized data access and other security concerns. This vulnerability underscores the importance of robust input validation and sanitization in software design.

Affected Version(s)

OpenClaw 0 < 2026.4.12

OpenClaw 2026.4.12

References

https://github.com/openclaw/openclaw/security/advisories/...
vendor-advisory
https://github.com/openclaw/openclaw/commit/08ae021d1f4f0...
patch
https://github.com/openclaw/openclaw/commit/ddb7a8dd80b8d...
patch

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yuki Shiroi (@threalwinky)
.